From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Andrey Konovalov <andreyknvl@google.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.8 10/49] dccp: do not send reset to already closed sockets
Date: Sat, 19 Nov 2016 10:23:02 +0100 [thread overview]
Message-ID: <20161119092038.316232001@linuxfoundation.org> (raw)
In-Reply-To: <20161119092036.698705716@linuxfoundation.org>
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 346da62cc186c4b4b1ac59f87f4482b47a047388 ]
Andrey reported following warning while fuzzing with syzkaller
WARNING: CPU: 1 PID: 21072 at net/dccp/proto.c:83 dccp_set_state+0x229/0x290
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 21072 Comm: syz-executor Not tainted 4.9.0-rc1+ #293
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
ffff88003d4c7738 ffffffff81b474f4 0000000000000003 dffffc0000000000
ffffffff844f8b00 ffff88003d4c7804 ffff88003d4c7800 ffffffff8140c06a
0000000041b58ab3 ffffffff8479ab7d ffffffff8140beae ffffffff8140cd00
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:15
[<ffffffff81b474f4>] dump_stack+0xb3/0x10f lib/dump_stack.c:51
[<ffffffff8140c06a>] panic+0x1bc/0x39d kernel/panic.c:179
[<ffffffff8111125c>] __warn+0x1cc/0x1f0 kernel/panic.c:542
[<ffffffff8111144c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
[<ffffffff8389e5d9>] dccp_set_state+0x229/0x290 net/dccp/proto.c:83
[<ffffffff838a0aa2>] dccp_close+0x612/0xc10 net/dccp/proto.c:1016
[<ffffffff8316bf1f>] inet_release+0xef/0x1c0 net/ipv4/af_inet.c:415
[<ffffffff82b6e89e>] sock_release+0x8e/0x1d0 net/socket.c:570
[<ffffffff82b6e9f6>] sock_close+0x16/0x20 net/socket.c:1017
[<ffffffff815256ad>] __fput+0x29d/0x720 fs/file_table.c:208
[<ffffffff81525bb5>] ____fput+0x15/0x20 fs/file_table.c:244
[<ffffffff811727d8>] task_work_run+0xf8/0x170 kernel/task_work.c:116
[< inline >] exit_task_work include/linux/task_work.h:21
[<ffffffff8111bc53>] do_exit+0x883/0x2ac0 kernel/exit.c:828
[<ffffffff811221fe>] do_group_exit+0x10e/0x340 kernel/exit.c:931
[<ffffffff81143c94>] get_signal+0x634/0x15a0 kernel/signal.c:2307
[<ffffffff81054aad>] do_signal+0x8d/0x1a30 arch/x86/kernel/signal.c:807
[<ffffffff81003a05>] exit_to_usermode_loop+0xe5/0x130
arch/x86/entry/common.c:156
[< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190
[<ffffffff81006298>] syscall_return_slowpath+0x1a8/0x1e0
arch/x86/entry/common.c:259
[<ffffffff83fc1a62>] entry_SYSCALL_64_fastpath+0xc0/0xc2
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Fix this the same way we did for TCP in commit 565b7b2d2e63
("tcp: do not send reset to already closed sockets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/proto.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1009,6 +1009,10 @@ void dccp_close(struct sock *sk, long ti
__kfree_skb(skb);
}
+ /* If socket has been already reset kill it. */
+ if (sk->sk_state == DCCP_CLOSED)
+ goto adjudge_to_death;
+
if (data_was_unread) {
/* Unread data was tossed, send an appropriate Reset Code */
DCCP_WARN("ABORT with %u bytes unread\n", data_was_unread);
next prev parent reply other threads:[~2016-11-19 9:36 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20161119092339epcas3p4464a1a8a19f9171b12871d8cfef3ea16@epcas3p4.samsung.com>
2016-11-19 9:22 ` [PATCH 4.8 00/49] 4.8.10-stable review Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 01/49] dctcp: avoid bogus doubling of cwnd after loss Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 02/49] net: clear sk_err_soft in sk_clone_lock() Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 04/49] bgmac: stop clearing DMA receive control register right after it is set Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 05/49] ip6_tunnel: Clear IP6CB in ip6tunnel_xmit() Greg Kroah-Hartman
2016-11-19 9:22 ` [PATCH 4.8 07/49] ipv4: allow local fragmentation in ip_finish_output_gso() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 08/49] tcp: fix return value for partial writes Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 09/49] dccp: do not release listeners too soon Greg Kroah-Hartman
2016-11-19 9:23 ` Greg Kroah-Hartman [this message]
2016-11-19 9:23 ` [PATCH 4.8 11/49] dccp: fix out of bound access in dccp_v4_err() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 12/49] ipv6: dccp: fix out of bound access in dccp_v6_err() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 13/49] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 14/49] sctp: assign assoc_id earlier in __sctp_connect Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 15/49] bpf: fix htab map destruction when extra reserve is in use Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 16/49] net: icmp6_send should use dst dev to determine L3 domain Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 17/49] fib_trie: Correct /proc/net/route off by one error Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 19/49] net: icmp_route_lookup should use rt dev to determine L3 domain Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 20/49] net: __skb_flow_dissect() must cap its return value Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 21/49] ipv4: use new_gw for redirect neigh lookup Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 22/49] tcp: take care of truncations done by sk_filter() Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 24/49] mlxsw: spectrum: Fix refcount bug on span entries Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 25/49] mlxsw: spectrum_router: Correctly dump neighbour activity Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 26/49] Revert "bnx2: Reset device during driver initialization" Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 27/49] bnx2: Wait for in-flight DMA to complete at probe stage Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 28/49] sctp: change sk state only when it has assocs in sctp_shutdown Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 29/49] net: stmmac: Fix lack of link transition for fixed PHYs Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 31/49] sparc: Handle negative offsets in arch_jump_label_transform Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 32/49] sparc64: Handle extremely large kernel TSB range flushes sanely Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 33/49] sparc64: Fix illegal relative branches in hypervisor patched TLB code Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 34/49] sparc64: Fix instruction count in comment for __hypervisor_flush_tlb_pending Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 35/49] sparc64: Fix illegal relative branches in hypervisor patched TLB cross-call code Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 36/49] sparc64: Handle extremely large kernel TLB range flushes more gracefully Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 37/49] sparc64: Delete __ret_efault Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 38/49] sparc64: Prepare to move to more saner user copy exception handling Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 39/49] sparc64: Convert copy_in_user to accurate exception reporting Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 40/49] sparc64: Convert GENcopy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 41/49] sparc64: Convert U1copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 42/49] sparc64: Convert NG4copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 43/49] sparc64: Convert NGcopy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 44/49] sparc64: Convert NG2copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 45/49] sparc64: Convert U3copy_{from,to}_user " Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 46/49] sparc64: Delete now unused user copy assembler helpers Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 47/49] sparc64: Delete now unused user copy fixup functions Greg Kroah-Hartman
2016-11-19 9:23 ` [PATCH 4.8 48/49] usb: gadget: f_fs: edit epfile->ep under lock Greg Kroah-Hartman
2016-11-19 16:21 ` [PATCH 4.8 00/49] 4.8.10-stable review Guenter Roeck
2016-11-19 16:58 ` Greg Kroah-Hartman
2016-11-21 16:32 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161119092038.316232001@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andreyknvl@google.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.